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We introduce a simple protocol for verifiable measurement-only blind quantum computing. Alice, 
a client, can perform only single-qubit measurements, whereas Bob, a server, can generate and store 
entangled many-qubit states. Bob generates copies of a graph state, which is a universal resource 
state for measurement-based quantum computing, and sends Alice each qubit of them one by one. 
Alice adaptively measures each qubit according to her program. If Bob is honest, he generates the 
correct graph state, and therefore Alice can obtain the correct computation result. Regarding the 
security, whatever Bob does. Bob cannot learn any information about Alice’s computation because 
of the no-signaling principle. Furthermore, malicious Bob does not necessarily send the copies of 
the correct graph state, but Alice can check the correctness of Bob’s state by directly verifying 
stabilizers of some copies. 


Blind quantum computing is a quantum cryptographic 
protocol that enables Alice (a client), who does not have 
any sophisticated quantum technology, to delegate her 
quantum computing to Bob (a server), who has a suf¬ 
ficiently powerful quantum computer, without leaking 
any her privacy. The first protocol of blind quantum 
computing that uses the measurement-based quantum 
computing [ll was proposed by Broadbent, Fitzsimons, 
and Kashefi [2|, and a proof-of-principle experiment was 
demonstrated with photonic qubits [3| . In the protocol of 
Ref. Q, Alice generates many randomly-rotated single¬ 
qubit states, and sends them to Bob. Bob generates a 
universal resource state of the measurement-based quan¬ 
tum computing by applying entangling gates on qubits 
sent from Alice. Then, they do two-way classical com¬ 
munications: Alice instructs Bob how to measure each 
qubit, and Bob returns measurement results so that Al¬ 
ice can perform the feed-forward calculations. It was 
shown in Ref. Q that if Bob is honest, Alice can obtain 
the correct quantum computing result (which we call the 
correctness), and that whatever evil Bob does, he cannot 
learn anything about Alice’s input, output, and pri^ram 
(which we call the blindness) Q. (See also Ref. for 
a precise proof of the security.) Inspired by the seminal 
result, plenty of improvements have been done 
For example, it was shown that instead of single-qubit 
states generation, single-qubit measurements or co¬ 
herent states generation are sufficient for Alice. In 
the protocol of Ref. so called the measurement-only 
blind quantum computing. Bob generates a universal re¬ 
source state of measurement-based quantum computing 
(Fig[TJa)), and sends each qubit of the resource state one 
by one to Alice (Fig. (Ub)). Alice adaptively measures 
each qubit according to her program (Fig. (Ub)). Since 
adaptive sin gle - qub it measurements on certain states are 
universal |l]. l2ll - l^ . Alice with only single-qubit measure¬ 
ments ability can perform universal quantum computing 
if Bob prepares the correct resource state. Furthermore, 
since this protocol is a one-way quantum communication 
from Bob to Alice, the blindness is guaranteed by the no¬ 


signaling principle Q. Here, the no-signaling principle 
is one of the most fundamental assumptions in physics, 
which says that if Alice and Bob share a system she can¬ 
not transmit any her message to Bob whatever they do on 
their systems. Quantum physics respects the no-signaling 
principle. 


(a) (b) 
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FIG. 1: The measurement-only blind quantum computing, 
(a) Bob generates a resource state, (b) Bob sends Alice each 
qubit of the resource state one by one. Alice adaptively mea¬ 
sures each qubit. 

In addition to the correctness and the blindness, the 
verifiability is another important requirement for blind 
quantum computing. The verifiability means that Al¬ 
ice can check the correctness of Bob’s computation. Al¬ 
though the blindness guarantees that Alice’s privacy is 
kept secret against malicious Bob, it does not guaran¬ 
tee the correctness of the computation result with ma¬ 
licious Bob: Bob cannot learn Alice’s secret, but he 
can mess up the computation. In order to avoid being 
palmed off a wrong result, Alice needs some statistical 
test to verify the correctness of Bob’s computing. There 
are several protocols that enable verifiable blind quan¬ 
tum computing [sl-flTi [^ . . Some of them d, [24|, [2^ 

elegantly achieve the completely classical client, but a 
trade-off is the requirement of more than two servers 
who do not communicate with each other. Although 
pursuing the completely classical client is an important 
direction, in particular, for the goal of constructing an 
interactive proof of BQP, where the assumption of non¬ 
communicating multi provers is natural, in this paper 
we restrict ourselves to the single-server setup assum¬ 
ing some minimum quantum technologies for the client, 
since in the context of blind quantum computing, as- 
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suming some minimum quantum technologies for the 
client is more realistic than to assume that the client 
can verify that remote servers are not communicating 
with each other. These results also achieve the device 
independence. Although our protocol assumes the cor¬ 
rectness of measurement devices, it enables to derive a 
more practical bound suitable for experiments. Proto¬ 
cols in Refs. iEini need only a single server by as¬ 
suming some minimum quantum technologies, which are 
available in today’s laboratories, for the client. (The pro¬ 
tocol of Ref. remiires single-qubit states generations, 
and those of Refs. H, m require single-qubit measure¬ 
ments for the clien^ The idea of the verification in the 
protocols of Refs. [8l-[lll| is to use trap qubits: Alice se¬ 
cretly hides trap qubits in the resource state, and any dis¬ 
turbance of a trap signals Bob’s dishonesty iOl. An 
experimental demonstration of the idea was done with 
photonic qubits [^ . 

In this paper, we propose another protocol for verifi¬ 
able measurement-only blind quantum computing. The 
blindness is again guaranteed by the no-signaling princi¬ 
ple like Ref. Q. The verifiability is, on the other hand, 
achieved in a more straightforward way: instead of hid¬ 
ing traps, Alice directly checks whether the state sent 
from Bob is correct or not by testing stabilizers [^ . 
Alice asks Bob to generate 2fc -I- 1 copies 
the graph state |G), where |G) is an n-qubit graph state 
and k = poly{n). The graph state |G) is defined by 

|G) = ({g),g^GZe)|+)®-, where |+) = ^(|0) + |1)), E 
is the set of edges of G, and CZf. is the Controlled-Z gate, 
CZ = |0)(0|(8>/-|-11)(1| (8)^, acting on the pair of vertices 
sharing the edge e. The graph state |G) has the stabiliz¬ 
ers Zi, for j = 1,2, ...,n, where N{j) is the 

set of the vertices connected to j. Alice uses randomly 
chosen 2k copies of check stabilizers, and the 

rest of it for her computation. If Bob is honest, he gen¬ 
erates ^^^ ghow tliat she 

passes the test with probability 1. If Bob is evil, on the 
other hand, he might generate another n(2k + l)-qubit 
state. However, we will show that if she passes the test, 
the closeness of the single copy to the correct graph state 
|G) is guaranteed with a sufficiently small significance 
level. Any graph state can be used for our protocol as 
long as the corresponding graph G is bipartite. There¬ 
fore, for example, Alice can perform the fault-tolerant 
topological measurement-based quantum computing [2l| 
by taking |G) as the Raussendorf-Harrington-Goyal lat¬ 
tice [2l| (Fig. [Ha)). 

Note that there are several proposals for testing quan¬ 
tum gate operations [13, mi, but testing quantum circuit 
models assumes the identical and independent properties 
of each gate, and suffers from the scalability and complex¬ 
ity of the analysis. On the other hand, our result in the 
present paper (and Ref. [l^l) demonstrate that testing 
quantum computing becomes much easier if we consider 
a measurement-based quantum computing model, which 
is a new interesting advantage of the measurement-based 


quantum computing model over the circuit model. For 
more details about the relations between our result and 
previous works, see Appendix. 

Protocol .— Our protocol runs as follows: 

1. Honest Bob generates |G)® 2 fe+i^ where |G) is an 
n-qubit graph state on a bipartite graph G, whose 
vertices are divided into two disjoint sets W and 
B. (Fig. IHa) and (b).) Bob sends each qubit of 
it one by one to Alice. Evil Bob can generate any 
n(2k + l)-qubit state p instead of [G)®^^’*'^. 

2. Alice divides 2fc -I- 1 blocks of n qubits into three 
groups by random choice. (Fig. IHc)-) The first 
group consists of k blocks of n qubits. The second 
group consists of k blocks of n qubits. The third 
group consists of a single block of n qubits. 

3. Alice uses the third group for her computation. 
Other blocks are used for the test, which will be 
explained later. (Fig. |Hc).) 

4. If Alice passes the test, she accepts the result of the 
computation performed on the third group. 



W P I.. 
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test test computation 

FIG. 2: (a) The RHG lattice, (b) An example of bipartite 

graphs: the two-dimensional square lattice. Black and white 
colors indicate the bipartitions B and W, respectively, (c) An 
example for n — 3, k = 2. Two blocks go to the first group 
and the other two blocks go to the second group. The left 
block goes to the third group. 

For each block of the first and second groups, Alice 
performs the following test: 

1. For each block of the first group, Alice measures 
qubits of W in the Z basis and qubits of B in the 
A basis. (Fig. |Ha).) 

2. For each block of the second group, Alice measures 
qubits of B in the Z basis and qubits of W in the 
A basis. (Fig. |Hb).) 

3. If the measurement outcomes in the A basis coin¬ 
cide with the values predicted from the outcomes 
in the Z basis (in terms of the stabilizer relations), 
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then the test is passed. If any outcome in the X ba¬ 
sis that violates the stabilizer relations is obtained, 
Alice rejects. 

(a) (b) 


FIG. 3: An example for the two-dimensional square lattice. 
The measurement pattern for the hrst group (a) and the sec¬ 
ond group (b). 


2. For the test of a maximally-entangled state, veri¬ 
fications of coincidences of X measurement results 
with Z measurement results are sufficient. Further¬ 
more, since we are interested in the fidelity between 
the given state and a maximally-entangled state, 
we can consider, without loss of generality, the dis¬ 
cretely twirled version of the given state, which 
drastically simplifies the problem [^ . 

3. Finally, since we check the coincidence or discrep¬ 
ancy of the measurement results between two par¬ 
ties of the given bipartite cut, we have only to con¬ 
sider a distribution on (0,0), (0,1), (1, 0), and (1,1) 
for each block, and therefore we can reduce the 
problem to a classical hypothesis testing. 




Analysis .— Let us analyze the correctness, blindness, 
and verifiability of our protocol. First, our protocol is a 
one-way quantum communication from Bob to Alice, and 
therefore, the blindness is guaranteed by the no-signaling 
principle as in the protocol of Ref. @. Second, it is ob¬ 
vious that if p = then Alice passes the test 

with probability 1. Therefore, if Bob is honest, Alice 
passes the test with probability I and she obtains the 
correct computation result on the third group. Hence 
the correctness is satisfied. Finally, to study the verifia¬ 
bility, we consider the following theorem: 

Theorem 1 Assume that a > 2 k+i ■ If the test is passed, 
with significance level a, we can guarantee that the resul¬ 
tant state a of the third group satisfies 


{G|a|G) > I 


1 

a{2k 1) 


( 1 ) 


(Note that the significance level is the maximum passing 
probability when malicious Bob sends incorrect states so 
that the resultant state a does not satisfy H]) [1^.) The 
proof of the theorem is given below and in Appendix. 
From the theorem and the relation between the fidelity 
and trace norm [s^, (6.106)], we can conclude the verifi¬ 
ability: If Alice passes the test, she can guarantee 


Tr(Ga)-Tr(G|G)(G|) 


< 


C({2k 1) 


for any POVM G with the significance level a. If we 
take a = ^^k+i ’ example, the left-hand side of the 
above inequality is ( 2 fc-Ki)F<^ —0 if fc —?► oo, and therefore 
the verifiability is satisfied. Note that the lower bound, 
a > 2 k+i ! of the significance level a is tight, since if Bob 
generates 2k copies of the correct state |G) and a single 
copy of a wrong state. Bob can fool Alice with probability 
2 ^:fl , which corresponds to a = ^k^i ■ 

Proof of Theorem .— The proof of the theorem is based 
on several interesting insights: 

1. By considering an appropriate subspace, we can 
reduce the problem to the test of a maximally- 
entangled state. 


Let us explain the first point. Employing suitable 
classical data conversions, we can assume the following. 
The systems TLb and TLw are written as ICb Z) IC'g and 
ICw Z> IC\y by using an n^-qubit system ICb and an n(y- 
qubit system K-w, respectively. We denote the eigenstate 
corresponding to the eigenvalue all 0 of A’s in ICg by 
I+)b': which is the graph state with isolated sites with 
no edge. Similarly, we define \-\-)w'- So, we find that 
the systems ICb and ICw are the same dimension, i.e., 
n'g = n'^r- Let |G') be the graph state on Kb ® Kw 
whose graph is composed of isolated edges. The true 
state is given as the state |G') ® |+)b' ( 8 ) \+)w'- In this 
way, we can reduce the problem to that of the maximally- 
entangled state. Note that Alice’s measurements on Pb 
and TLw are replaced by on Kb and Kw, respectively. 
Applying the original Alice’s measurement, Alice can re¬ 
alize the above modified measurement. The detail of this 
discussion is given in Appendix. 

Now let us explain the second point. We focus on the 
Hilbert space {Kb ■ Since the three groups 

are randomly chosen, the state p is permutation invari¬ 
ant. Let us denote elements of F 2 ® by a; = {xi ,..., )j 
etc. We define operators ZA = X^^ ® ■ ■ ■ ® X^"b , 
= Z^^ ®---® , on (C 2 )®"b , which satisfy 

0 Z^^\G') = \G'), 0 Z^^G') = |G'). (2) 

In the following, we regard X|j, as operators on Kb 
and X^, Z^ as operators on Kw- Here, we distinguish 
X and —a; so that we can easily extend our analysis to 
the qudit case. 

Furthermore, for x = {x^,... G and 

z = (z^,..., € (F 2 ^)^^+^, using the operator 

= X)jZ|j on Kb, we define 0 • • • 0 

\Ng on Also, we define on Kw, 

and on , in the same way. Eq. ([2]) implies 

that 0 = |G')®2fc+i. Hence, 


Tr 


(W^'^ 0 0 W^^ ~’‘)|G')(G'|®^''’^^ 


= Tr(p|G')(G'|®^''’^^)- 
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Thus, the discrete-twirled state 
P = J2 (W^’" (g) p{^b" ® ^w'~") 

X,Z 

satisfies Tr(p|G'){G"|®^''+^) = Tr(p|G')(G'|®2fe+i) [^. 
Also, we have 


Tri 

(Tr2.3p)|G')(Gr'= 

= Tn 

(Tr2.3p)|G'){Gr" 

Tr2 

'(Tri,3p)|G')(Gr" 

= Tr2 

■(Tri.3p)|G')(Gr" 

Tra 

■(Tri.2p)|G')(G'| 

= Tra 

■(Tri,2p)|G')(G'| 



Therefore, we have only to consider the discretely twirled 
version of p. Note that the upper subscript of x and z 
expresses the choice of group, and the lower subscript of 
X and z expresses the site of the modified graph. 

Finally, let us explain the third point. Since (W^’^ ® 
(g) = p and p is permutation- 

invariant, the state p is written with a permutation- 
invariant distribution P on as [1^ 

p = ^ P(x, z)\NY |G'®"'=+i) (G'®"'=+^ I 


the probability P{Sj = = 0 for 1 < j < A:) is upper 

bounded by a. 

In this way, we have reduced the problem to the classical 
hypothesis testing. The proof of Theorem [5] is given in 
Appendix. 
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Appendix A: Relation to previous works 


Then, we define the function / from to 

({0, l}2)(2fc-ti) as / : (x,z) (si,ti),..., {s 2 k+i,t 2 k+i), 


, j 0 if = 0 , , 

where Si := < , -c i / n and ti 
[1 it X ^ 0 

Here, x* and z® are elements of 


JO if z* = 0 
[I if zV 0. 
So, 0 in the above 


conditions expresses the zero vector in F^^ although Si 
is an element of F 2 . 

We introduce the distributions 

P{{si,ti),...,{s 2 k+i,t 2 k+i)) on ({0, as 

P := P0/-1. 

Once, Bob’s operation is given, the values 
si,..., S 2 fc-i-i, ti,..., t 2 k+i are given as random variables 
although half of si,..., S 2 fc, C, ■ • ■, t 2 k can be observed. 
To employ the notations of probability theory, we 
express them using the capital letters as Si,, S 2 k+i, 
Ti,... ,T 2 k+i. Hence, P{Si = 0) expresses the proba¬ 
bility that the i-th measurement outcome of X basis 
of B system coincides with the prediction by the i-th 
measurement outcome of Z basis of W system. So, to 
show Theorem [ll it is enough to show the following the¬ 
orem. Similarly, P{Tk+i = 0) expresses the probability 
that the k -I- i-th measurement outcome of X basis of 
W system coincides with the prediction by the k + i-th 
measurement outcome of Z basis of B system. So, to 
show Theorem [U it is enough to show the following 
theorem. 


Here we discuss relations between our result and previ¬ 
ous works. The hypothesis testing of an entangled state 
by local measurements was initiated by the paper [ 3 ^ . 
The paper [s^ treats only the maximally entangled state. 
The next paper [s^ derived its asymptotic opti mal p er- 
formance in the i.i.d. setting. Then, the papers j35l - l38l| 
extended these results to the case of a non-maximally en¬ 
tangled state. However, these papers consider only the 
locality condition between two parties. To apply the hy¬ 
pothesis testing to the blind quantum computation based 
on the measurement based quantum computation, we 
need the following conditions. 

(1) The test can be applied to the case of a graph state. 

(2) Our quantum operations are restricted to single¬ 

qubit measurements. 

Since the previous studies [33l - [^ do not satisfy both 
conditions, we cannot use them. The papers [11,143 sat¬ 
isfy these conditions as the verification of graph states, 
but their results assume i.i.d. samples, which is somehow 
reasonable in laboratory experiments, but cannot be ac¬ 
cepted in quantum cryptography where a malicious ad¬ 
versary can do anything. That is, we need the following 
additional requirement. 

(3) We cannot assume i.i.d. samples. 


Theorem 2 Assume that a > 2 fc^- When the distribu¬ 
tion P satisfies 

P{S 2 k+i = T 2 k +1 = OlS'j = Tk+j =0forl<j<k) 
~ a{2k 1) ’ 


Therefore, these results cannot be directly used for the 
verification in blind quantum computing. Our protocol 
satisfies all of these conditions. 

The verification in blind quantum computing was ini¬ 
tiated in Ref. 0- The idea of their protocol is to use 
the trap technique: Alice secretly hides isolated qubits 
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as traps, and if a trap is changed by Bob, she can de¬ 
tect his malicious behavior. Sever al g eneralizations of 
Ref. d have been obtained [ill . 1 ^ . 1 ^ , but all of them 
essentially use the same idea, namely, the trap technique. 
Our protocol, on the other hand, uses a completely dif¬ 
ferent technique for the verification, i.e., the direct graph 
state testing, for the first time. 

The graph state verification is also used in the context 
of the multiprover interactive proof system. For exam¬ 
ple, Ref. gave an elegant protocol that uses a device¬ 
independent graph state verification. However, the re¬ 
sults in multiprover interactive proof system can neither 
be directly used in blind quantum computing, since the 
assumption that provers do not communicate with each 
other is not natural in the blind quantum computing. 


Appendix B: Analysis of local conversion for a 
bipartite graph state 


We show how the graph state jG) is converted to 
|G') 0 |+)b' 0 \+)w'- For this purpose, we define the 
notations more formally. When the true state is |G), 
the outcome of measurement with X basis in the party 
B takes values in the subspace over the finite filed F 2 . 
We denote the subspace by Vb, and denote its dimen¬ 
sion by n'g. The orthogonal complement is denoted by 
Vg. Then, the space of the measurement outcome with 
X basis in the party B is written as Vb So, we 

denote the Hilbert space corresponding to Vb and by 
/Cb and IC'g, respectively. Then, we have Hb = ICb^IC'b- 
We denote the eigenstate corresponding to the eigenvalue 
all 0 of A’s in ICg by |-I-)b' , which is the graph state with 
isolated sites with no edge. Similarly, we define Vw, Fiy, 
|+)w' and have Bw = ® ^'w 

and n'y^ = n'^. Then, we define the graph state |G') on 
/Cb 0 Bw whose graph is composed of isolated edges. In 
the following, we show that the true state is given as the 
state \G') 0 |-|-)b' 0 |+)w'- 

For an invertible ub x b-b matrix G, we define the 
unitary operator Uc,z,b as 

Uc,z,B ■= ^ |C'^)b b{z\- 


Using the X basis states \x)x,b, we define the unitary 
operator Uc,x,b as 


which can be shown as follows. 


Uc,x,b\z)b 

H \‘^^)x,B x,b{x\ (-1)'"12:)b 

xeFj® x'eF”® 

xGFj ® 

k'GF"® 

Similarly, we can define Ud,x,w and Ud,x,w for an in¬ 
vertible nw X nw matrix D. 

Next, given the graph state |G), we define the ubX nw 
matrix A = (aij) as follows. When the site j of W is 
connected to the site i of B, aij is 1. Otherwise, is 
zero. Then, we have 

1*^) = \Az)x,b\z)w- 

2GF2 w 

Then, when we measure W with the Z basis and obtain 
the outcome z, we obtain Az with the X measurement 
on B. Then, we have 

2GF2® 


because any vector z' S satisfies 


b{z'\G) 
1 


1 


■2"b/2 


Z X,b{x\{-1Y'^ ^ \Az)x,b\z)w 


1 ^1 


zGF, 


'2"b/2 

1 


^n-w jl 


Z 


zGF, 


1^ z')x,w- 


Now, we choose a basis ci,...,c„^ of the n'g- 
dimensional subspace Vb that is composed of the possible 
outcomes with X basis in B. Also, we choose ub — n'g 
vectors ..., Cng of F 2 ® such that ci,..., c„g form 

a basis of F 2 ^. We choose n'w vectors di,..., of F 2 
such that Ci = Adi, and choose a basis ..., of 

the kernel of A. Then, we define the invertible ub x ub 
matrix G and the invertible nw x nw matrix D by 


Uc,x,B '■= Z \^^)x,B x,b{x\. 

xGF”® 


Then, we have the relation 


G — (ci... c^iB ) 

D — (di ... dny ^). 

So, we define the bb x nw matrix A' := G~^AD, which 
is written as 



Uc,x,B = U(^c-^V ,Z,B^ 


A! = 
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So the state ya SzeFj”' x,b\z)w corresponds to 
the graph with many isolated edges and many isolated 
sites. Hence, it can be regarded as the state 1^?')®!+)s'® 
\+)w'- 

Now, we have 

zGF"”' 

= ^ 17 ^ H \C-^ADz)x,b\^)w 

zGF"”' 

= ^ 11 :^ H \C~^Az)x,b\D~^^)w 

zGF"”" 

= Uc~^,X,bUd-\Z,W 2nw/2 X! \^^)x,b\z)w 

zGFJ"' 

=Uc-^ ,x.bUD-^ .z,w\G) 

= Uctx,bUdt^X,w\G) 

zGF”s 

= \C^^)b\D^A^z)x,w- 

zGFjS 

Hence, [G) can be converted to the state |G') ( 8 ) |+)_b' 8 
|+)w' via the local unitary When we 

apply the Z measurement on W and the X measurement 
on B, the application of the unitary Uc-^,x,bUd-^,z,w is 
equivalent with the application of the classical conversion 
X I—> C~^x and z i— D~^z. Similarly, when we apply 
the Z measurement on B and the X measurement on 
W, the application of the unitary Uc-i^x,bUd-^.z,w is 
equivalent with the application of the classical conversion 
X !->■ D'^x and z h->- C^z. Hence, applying these classical 
data conversions, we can treat the state |G) as the state 
|G') 8 |+)b' 8 \+)w'- 


that C = 


1 1 
1 0 


and G ^ 


0 1 
1 1 


Also, we have 


D = 1. Therefore, the required classical data conversions 
are given as follows. When we obtain Xi and X 2 as the 
X measurement on B, and Z\ the Z measurement on 
W, we need to use the data A 2 , X\ + X^^ Z\ instead of 
the original data. That is, we check whether the relation 
A 2 = Z\ holds. When we obtain Z\ and Z 2 as the Z 
measurement on B, and Xi the X measurement on IT, 
we need to use the data Zi + 82 , Zi, Xi instead of the 
original data. That is, we check whether the relation 
Xi = Zi T Z 2 holds. 


2. Four-qubit graph state 


Next, we consider the four-qubit graph state on the 
graph • — o — • — o. We number the left black circle 1 
and do the right black circle 2. Similarly, we number the 

white circles. Then, the matrix A = ( | ^ V Now, we 


choose Cl 


1 

1 


and C 2 


0 

1 


which implies that 


C = A and G ^ ^ | ^ y' have D = D ^ = 

I. Therefore, the required classical data conversions are 
given as follows. When we obtain Xi and X 2 as the X 
measurement on B, and Zi and Z 2 the Z measurement 
on W, we need to use the data Xi -|- X 2 , X 2 , Zi, and Z 2 
instead of the original data. That is, we check whether 
the relations Xi + X 2 = Z\ and A 2 = Z 2 hold. When 
we obtain Zi and Z 2 as the Z measurement on B, and 
Ai and X 2 the X measurement on W, we need to use 
the data Zi, Zi -I- Z 2 , Xi, and A 2 instead of the original 
data. That is, we check whether the relations Xi = Zi 
and A 2 = Zi -b Z 2 hold. 


Appendix D: Analysis of the classical hypothesis 
testing problem 


Appendix C: Concrete examples 

Here, for a better understanding, we demonstrate the 
above results for few-qubit graph states. 


In this appendix, we show 
Lemma 1 When the distribution P satisfies 
P{Sj = Tk+j =0forl<j<k)> a. 


1. Three-qubit graph state 


Let us consider the case of the three-qubit graph state 
on • — o — We number the left black circle 1 and do the 

right black circle 2. Then, the matrix A = ( I ). Then, 


Cl = 


Now, we have two choices for C 2 , 

which implies 


and I ^ ) • Then, we choose C 2 = 


we have 


.P( 5 ' 2 fe-i-i = T' 2 fc+i = 0\Sj = Tk+j = 0forl<j<k) 


a(2k -b 1 ) 

Here, P is a distribution on 2fc -b 1 trials, in which, each 
trial consists of two bits. Also, it is invariant for permu¬ 
tation 0 / 2 fc -b 1 trials. 

Since Lemma [1] is the contraposition of Theorem 2 in the 
body, it is sufficient to show Lemma [TJ 
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To address permutation-invariant distributions on 2k+ 
1 trials, we prepare the typical permutation-invariant dis¬ 
tribution Pa,b,c, in which, the possible numbers of events 
(0, 0), (1, 0), (b, 1), and (1,1) are fixed to 2k+l—[a+h-\-c), 
a, 6, and c, respectively. Hence, the real numbers a, b and 
c satisfy that a, 6, c > 0 and 2fc-|-l>a-|-6-l-c. Then, an 
arbitrary permutation-invariant distribution P is written 
as 


P=J2Qia^b,c)Pa,b,c, (Dl) 

a,&,c 

where Q is a distribution on the set {(a, 6, c)|a, &, c > 
0, a -I- 6 -I- c < 2fc -I- 1}. In the following discussion, we 
consider the properties of typical permutation-invariant 
distributions Pa,b,c with the above condition for {a,b,c). 

Consider the case when c > 2. Since we detect ”1” at 
least once among 2k outcomes Si,..., Sk, Tk+i ,..., T 2 k, 
we have 


Pa.bA^j = Pk+j = 0 for 1 < j < fc) = 0. 

Consider the case when c = 1. When a > fc -|- 1, we 
detect ” 1” at least once among k outcomes Tfe+i,..., T 2 k 
of X basis. Hence, we have 

Pa, bAS 3 = Tk+J = 0 for 1 < J < fc) = 0. (D2) 

When b > k + \, we can show (lD2]) in the same way. 
Assume that a,b < k. To realize Sj = Tk+j = 0 for 
1 £ j ^ the following conditions are required, a events 
(1,0) occur from k -|- 1-th trial to 2fc-th trial, b events 
(0,1) occur from 1-th trial to /c-th trial. One event (1,1) 
occurs in 2k + 1-th trial. Hence, k — a events (0,0) occur 
from k + 1-th trial to 2A:-th trial, k — b events (0,0) occur 
from 1st trial to fc-th trial. In this case, the number of 
total cases is (^ 2 k-a-b)\a\b<. ■ number of cases satisfying 

the above conditions is . Hence, we have 


Pa,b.iiSj = Tk+j = 0 for 1 < j < fc) 

k\ k\ 

_ (fe-a)!a! (fe-&)!b! _ k\k\{2k — a — b)\ 

( 2 fc+i)! - {2k + l)\{k - a)\{k - b)\ 

1 k ■ ■ ■ {k — a + 1) ■ k ■ ■ ■ {k — b + 1) 
~2k + l {2k)---{2k + l-a-b) 

1 

-2k + l' 


(D3) 


When Sj = Tk+j = 0 for 1 < j < fc, the event (1,1) 
occurs in 2k + 1-th trial, i.e., 5'2fc+i = T 2 k+i = 1- Thus, 


-Pa.&,i(*S' 2 fe-i-i = T 2 k+i = Sj = Tk+j = 0 for 1 < j < /c) 

=Pa,b.i{S2k+i = T2k+i = 0|S'j = Tk+j =0 ioT 1 <j < k) 
= 0 . 


Consider the case when c = 0. When a > k + 2 or 
b > k + 2, similar to (ID2|) . we can show that 


Pa,b,o{Sj = Tk+j = 0 for 1 < j < fc) = 0. 

Assume that a,b <k-\-l. The condition Sj = Tk+j = 0 
for 1 < j < fc holds when one of the following three sets 
of conditions holds. 


(1) 6—1 events (0,1) occur from 1st trial to fc-th trial, a 
events (1, 0) occur from fc-|- 1-th trial to 2fc-th trial. 
The event (0,1) occurs in 2k + 1-th trial. 


(2) b events (0,1) occur from 1st trial to fc-th trial, a — 1 
events (1,0) occur from k -|- 1-th trial to 2fc-th trial. 
The event (1,0) occurs in 2k -|- 1-th trial. 


(3) b events (0,1) occur from 1st trial to fc-th trial, a 
events (1,0) occur from k + 1-th trial to 2fc-th trial. 
The event (0,0) occurs in 2k + 1-th trial. 


The numbers of cases of (1), (2), and (3) are (q) , 

(b) ((o-i))’ (&) (a)’ respectively. Since the number of 

total cases is . Hence, we have 

(2fc+l —o—o)!o!o! ’ 












Pa,b.o{Sj = Tk+j = 0 for 1 < j < fc) 


(2fc+l)! 

(2fe+l-a-f))!a!&! 


_ (2fc + l-Q-6)!a!b! ^ ^ _1_ _1_ 

{2k + 1)! ^ ^a\{b - iy.{k - a)\{k - 6 + 1)! (a - l)!6!(fc - a + l)!(fc - 6)! 

{2k +1 — a — b)\a\b\ 2 f b{k — a + l) a{k — b+l) 

^ {2k + l)\ ^ ^a!6!(fc-a+l)!(/c-6+l)! a!6!(fc - a + l)!(fc - 6 + 1)! ' 

{2k + 1 — a — 6)!a!5! 2 — a + 1) + a{k — 6 + 1) + (/c — a + l)(fc — 6 + 1) 

^ {2k + l)\ ^ a!6!(/c-a+l)!(/fc-6+l)! 

{2k + 1 — a — by.albl 2 + 1)^ ~ 

^ (2fc + l)! ^ a!6!(fc-a+l)!(/c-6+l)! 

{2k + 1 — a — 6)!a!5! {{k + 1)!)^ {k + 1)^ — ab 

^ {2kTTjl (fc + l)2 a\bl{k - a + iy{k - b + ly. 

{k + 1)^ — ab {k + 1) ■ ■ ■ {k + 2 — a) ■ {k + 1) ■ ■ ■ {k + 2 — b) 

{k + 1)^ {2k + 1) • • • {2k + 2 — a — b) 


' ^ alb\{k - ay.{k - by^ 

{k — a + l){k — 6+1) 
a!6!(/c-a+l)!(fc-6+l)!^ 


(D4) 


Here, one might consider that {k + 1)^ can be canceled 
as a common factor. However, it is not true when a or 
6 is zero. To keep the validity even in this case, we need 
to keep the term {k + 1)^ in the denominator. 

Next, we proceed to Pa,b,Q{S 2 k+i = T 2 k+i = 0,Sj = 
Tk+j = 0 for 1 < j < k). The conditions Si = ... = 
Sk = Tk+i = ... = T 2 k = 0 holds when the conditions 
(3) holds. Hence, we have 

Pa,b,o{S 2 k+i = T 2 k+i = Sj = Tk+j = 0 for 1 < j < fc) 

00 

(2fc+l)! 

(2fc+l-a-b)!a!f)! 

(2/fc + l-a-6)!a!6! (fc!)^ 

“ (2A: +1)! a!6!(A:-a)!(/fc-6)! 

fc!A:!(2fc+l-a-6)! 

“(2fc + l)!(fc-a)!(/c-6)! 

_ fc • • • (fc + 1 — a) • fc • • • (fc + 1 — 6) 

(2fc + l)---(2A: + 2-a-6) ’ ^ ’ 


Thus, 


support {(a, 6)|0 < a < k,0 < b < k}, the distribution Q 
is written as 

( PQo{a,b) if c = 0 

Q{a,b,c)=< (1 -/3)(3i(a, 6) if c = 1 
I 0 otherwise. 


Define 


TilQo] := ^ Qo{a, b)Pa,b,o{Si = Tk+j = 0 for 1 < j < fc) 

(a,b) 

T 2 [Qi] := ^ Qi{a, b)Pa,b,i{Sj = Tk+, = 0 for 1 < j < k), 

(a,b) 


and 


T3[Qo] 

•— 'y ^ b')Pa + ^Q 

{a,b) 


S2k+1 — T2k+1 — Sj — Tk+j — 0 
for 1 < j < fc 


Then, we can show the following lemma. 
Lemma 2 Assume that 


Pa,b,o{S2k+l — T 2 k +1 — 
{k + 1 — a){k + 1 — 6) 
(fc + l)2-a6 ■ 


0|S'j = Tk+j = 0 for l<j<k) 


(D6) 


When 


a > 


1 

2fc + 1' 


(D7) 


In the following, we discuss the distribution Q instead 
of P because of imi). Due to the above calculation, the 
event Sj = Tk+j = 0 for 1 < j < A: occurs only when 
c = 0,1. To evaluate the probability of this event, it is 
sufficient to consider the case of c = 0,1. That is, we 
can restrict the support of the distribution Q to the case 
of c = 0,1. Hence, using a parameter /3 e [0,1] and a 
distribution Qq on the support {(a, 6)|a + 6 < 2fc + 1,0 < 
a</c + l,0<6<fc + l} and a distribution Qi on the 


/3Ti[Qo] + (1-/3)T2[Qi] >a. (D8) 

we have 

miQn] ^ 1 

/3Ti[Qo] + ( 1 -^)T 2 [Qi] - a{ 2 k + iy 

Since P{Sj = Tk+j = 0 for 1 < j < A:) = /3Ti[(5o] + 
(1 - P)T 2 [Qi] and P{S 2 k+i = T 2 k+i = 0|5, = Tk+j = 
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0 for l< 3 <k) = pt^\qS+P-%t^[QA ^ Lemma [2] yields 
Lemma [TJ Hence, it is sufficient to show Lemma [2j 
The tightness of Lemma [H i.e., that of Lemma [I] can 
be shown as follows. Assume that a < /3 = Oj 

and Qi{a,b) = (5a,o<5b,Oj which corresponds to the distri¬ 
bution P satisfying the following. The event (1,1) occurs 
only in one event, and the remaining 2 k events are (0, 0). 


Then, Eq. 


holds nevertheless 


m[Qo] 

/3Ti[Qo] + (1-/3)T2[Qi] 


0. That is, the distribution P breaks the condition 
P{Sj = Tk+j = 0 for 1 < j < fc) < a nevertheless 
P(S'2fc+i = T2fc+i = 0|S'j = Tk+j = 0 for 1 < j < fc) = 0. 
Hence, the constraint a > 2 k+i crucial. This situ¬ 

ation corresponds to the following Bob’s strategy. Bob 
generates 2k copies of the true state |G) and inserts only 
one bad state where x, z are non-zero elements. 

Then, Bob can success the cheat with probability 2 k+i ■ 
To show Lemma [21 we prepare the following lemma, 
which will be shown in the next section. 


Lemma 3 The relation 

(fc -|- 1 — a)(fc -1-1 — 6) 

(fc -I- 1)^ — ab 

1 (fc+1)^ 

2fc-h 1 (fc-h 1)2 - a6 

(2fc-H 1) ■ • • (2fc-h 2 - a - 6) 

(fc -I- 1) • • • (fc -I- 2 — a) • (fc -I- 1) • • • (fc -I- 2 — 6) 

(D9) 


holds for 2 k + 1 > a + b and fc -|- 1 > a, 6 > 0. 


Proof of Lemma\^ Due to (ID3I) . we have 
T2[Qi] < ^ 


2 k Pi 

Hence, Condition ([2]) and (ID7I) imply that 


> 


a — 


2k+l 


Ti[Q^]- 


2k+l 


(DIO) 


(Dll) 


and 


under the same condition. Taking the expectation for 
Qo, we have 


T3[Qo]>T,[Qo]-^^. (D13) 


Thus, we have 

PTsIQo] D) fdTslQo] 

f3T,[Qo] + {l-m[Qi] - /3Ti[Qo] + M 

T 3 [Qo] Q; — 

~ a Ti[Qo] - 2^+1 

= "^3[Qo] 1 1 

Ti[Qo\ — 2 k+i a{ 2 k + l) a{ 2 k + l) 

where (a) and (c) follow from (ID10|) and the combination 
of (|D13|) and (ID12|) . respectively. The remaining part 

16') follows from (IDllI) and the fact that - PT\-Qo] _ 

^ ^^ PP[Qo]+^ 

-is monotone increasing for /3. ■ 

P{Qq\+ ^k+1 


Appendix E: Proof of Lemma O 


Define 

£,{a,b,k) 

:=(fc -I- 1 — a)(fc -|- 1 — 6) — (fc -|-1)^ -I- ab 

(fc -|- 1)2 • (2fc -|- 1) • • • (2fc -|- 2 — a — 6) 

(2fc -I- 1) • (fc -I- 1) ■ • ■ (fc -I- 2 — a) ■ (fc -I- 1) • ■ • (fc -I- 2 — 6 ) 
(fc-f 1)2 ■ (2fc) • ■ • (2fc -f 2 - a - 6) 

(fc -I- 1) • • • (fc -I- 2 — a) • (fc -I- 1) • • • (fc -I- 2 — 6) 

— (a -I- 6)fc -I- 2ab — (a -I- 6). 

Since (ira is equivalent with ^(a, 6, fc) > 0, we show the 
non-negativity of ^(a, 6, fc) in this section. 


1. Organization 


> 5^. (D12) 

Due to the relations (ID4I) and (ID6I) , Lemma [2] guaran¬ 
tees that 

Pa,b,o{S 2 k+i = T 2 k+i = 0|S'j = Tk+j = 0 for 1 < j < fc) 
>1 - ^ .Pa,b,o(<5'j = Tk+j = 0 for 1 < j < fc)“^ 

when a and 6 satisfy the conditions a-|-6<2fc-|-l, 0< 
a < fe -I- 1, and 0 < 6 < fc -I- 1. Hence, 

Pa,b,o{S 2 k+i = T 2 k+i = Sj = Tk+j = 0 for 1 < j < fc) 

>A,b,o{Sj = Tk+j = 0 for 1 < j < fc) - 


Before proceeding to the detailed analysis, we overview 
the organization of this section. We firstly show the non¬ 
negativity of ^(a, 6, fc) for the cases with fc = 1,2,3 in 
Subsections IE 21 IE 31 and IE 41 In the remaining subsec¬ 
tion, we show it for the cases with fc > 4. The detail or¬ 
ganization can be summarized as follows. Without loss of 
generality, we can assume that a > b due to the symmetry 
of ^(a, 6, fc). Remember that the relations fc-|-l>a, 6>0 
and 2fe -I- 1 > a -I- 6 are also assumed. 


a. Cases: fc = 1, 2, 3 

Combining discussions in Subsections IE 21 IE 31 and 
IE 41 we can cover all of cases with fc = 1,2,3 due to 
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the following reasons. The cases with k = 1 are com¬ 
posed of (a,&) = (0,0), (1,0), (1,1), (2,0), (2,1), (2, 2). 
The cases with k = 2 are composed of (a, b) = 
(0,0), (1,0), (1,1), (2,0), (2,1), (2,2), (3,0), (3,1), (3,2). 
These cases are covered in Subsection IE 21 

The cases with fc = 3 are composed of (a, 6) = 
(0,0), (1,0), (1,1), (2,0), (2,1), (2,2), (3,0), (3,1), (3,2), 
(3, 3), (4, 0), (4,1), (4, 2), (4, 3). In fact, the case with 
(a, 6, fc) = (3,3,3) is covered in Subsection IE 41 and the 
cases with (a, 6, fc) = (4, 0,3), (4,1, 3), (4, 2,3), (4,3, 3) 
are covered in Subsection IE 31 So, combining the cases 
discussed in Subsection IE 21 we can show the cases 
with fc = 3. So, we assume that fc > 4 in the following 
discussion. 


b. Cases: a < 2 and k > 4 


(a, 6), ^{a,b,k) can be calculated as follows. 


^(0,0, fc) 

^(1,0, fc) 
^(1,1, fc) 
^(2,0,fc) 
^(2,l,fc) 

?(2,2,fc) 

^(3,0,fc) 

^(3,l,fc) 

^(3,2,fc) 


(fc + 1)^ 

2fc-bl ’ 

0 , 

0 , 

0 , 

k — 1, 

4 (^ 

k 

(fc + l)2 
k-1 ’ 

4fc-2, 

llfc2 - 25A:-b 12 
k 


The cases with a <2 are covered in Subsection IE 21 The above values are non-negative when k > a,b. 


c. Cases: a + 6 < 5 and k > 4 


Many cases with a -I- 6 < 5 are covered in Subsection 
IE 21 The remaining cases are (a, b) = (4, 0), (4,1), (5, 0). 
The cases {a,b) = (4,0), (5,0) are covered in in Subsec¬ 
tions IE 51 and the case (a, b) = (4,1) is covered in in 
Subsections IE 61 


d. Cases: a + b>6, a>3 and k > 4 


The cases with a-|-6>6,a>3 and k > 4 are classified 
as Table HI Hence, all cases have been covered. 


TABLE I: Cases with a-|-6>6, a>3 and k > 4 


Subsection 

Condition 1 

Condition 2 

Condition 3 

IeTI 

a = b 

^ >a 

- 

lE8l 

^ <a 

- 

lE9l 

a> b 4- 4 

^>b 

b>2 

lE5l 

6 = 0 

in 

6 = 1 

lElQ] 

^ < b 

- 


3. Case: a = k + i 


C{k + 1, b, k) 

{2k) ■■■{k + l-b) 
"k\{k---{k + 2-b)) 


-(fc + l)2 + 6(fe + l) 


=(* + - {k + \ - b)) 


'k\{{k + l)---{k + 2-h)) 


=(fc + l)(fc+l-5)( 


{2k)---{k + 2-b) 
fc!((fc + l)---(fc + 2-6)) 


- 1 ) 


+ mk +1 - + + + _ 1 ) 


k{k — 1) • 2 


> 0 . 


4. Case: (a, b) = (3, 3) 


^(3,3, k) can be calculated as follows. 


2. Case: {a,b) = 

(0, 0), (1, 0), (1,1), (2, 0), (2,1), (2, 2), (3, 0), (3,1), (3, 2) 


?(3,3,fc) = ^|^_f) (13fc"-29fc+12). (El) 


Since the function ^(a, b, k) is symmetric for a and 6, 
we consider only the case when a > b. For specific values 


The case (a, b) = (3, 3) is possible only when fc > 3. It is 
positive in this case. 
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5. Case: 6 = 0 and a > 2 


8. Case: a — b, k > a > and fc > 4 


Since ^2“ \ we have 

^ 2k---{2k + 2-a)-{k + l) ,, 

=- k...ik + 2-a) - 

,, . .2k ■ ■ ■ (2k + 2 — a) , 

>(/c + l)(2“-^ - a) > 0. 


6. Case: 6=1 and a > 3 


Since the relations > 2“ ^ and > 

1 hold, we have 


=2k 


— (a + l)k + a — 1 


^(a,l,fc) 

2fc - 1 (2fc - 2) • ■ • (2fc + 1 - a) 
k {k — 1) ■ ■ ■ {k + 2 — a) 

>2°‘~^k — (a + l)fc + a — 1 

(a) 

=(2“-^ - a - l)fc + a - 1 > 0, 
where (a) follows from the inequality a > 3, respectively. 

7. Case: a = 6, a > 3, and > a 
We have 

{2k - l)i2k - 2) ■ • • (2fc + 5 - 2a){2k + 4-2a) 
((A:-l)---(fc + 2-a))2 

>22(a-2)_ ^g2) 

Since > a, we have 

{2k + 3 — 2a) {2k + 2 — 2a) 

- k - - - k - - ^ 

Thus, the combination of (IE2I1 and (IE3I1 yields that 

2fc • • • (2fc + 2 - 2a) 

{k - ■ ■ {k + 2 — a))2 

{2k - l){2k - 2) • ■ • (2fc + 5 - 2a){2k + 4 - 2a) 


=2k 


((fc-l)---(fc + 2-a))2 

{2k + 3 — 2a){2k + 2 — 2a) 


fc2 


>22(“-2)+1A:. 

Therefore, 


(E4) 


2fc • • • (2fe + 2 - 2a) 


^(a, a, k) =-=- )- —i--— 2ak + 2{a^ — a) 


{k - ■ ■ {k + 2 — a))2 


(a) 


> 2^(“-2)+ife - 2ak + 2{a^ - a) 


(b) 


={ 2 ^(a- 2 )+i _ 2^);, 2(0^ - a) > 0, 

where (a) and (6) follow from (|E4I) and the inequality 
a > 3, respectively. 


Firstly, we show 


{2k - l){2k - 2) ■ ■ ■ k 


(fc(ft-1) •••([!]+ i))-(Mfc-i) •••([!]+ 1)) 


(E5) 


>2fc-2_ 

When k is an even number 2s, 

(2fc- 1)(2A:- 2)---fc 

(fc(fc-l)...([|J+l)).(fc(fc-l)...(r|l+l)) 

(4s-l)(4s-2)---(2s) 

"((s2)(2s-l)---(s + l))2 

(4s - l)(4s - 3) • ■ • (2s + 1) (4s - 2)(4s - 4) ■ • ■ (2s) 
(2s)(2s-l)---(s + l) (2s)(2s-l)---(s + l) 

^ (4s - l)(4s - 3) • ■ • (2s + 3) (4s - 2)(4s - 4) • • • (2s + 2) 
- (2s - l)(2s - 2) • • • (s + 1) (2s - l)(2s - 2) • • • (s + 1) 
>2®“^ ■ 2®“^ = 2^®“2 = 2'"“^. 

When k is an odd number 2s + 1, 

(2A:-l)(2A:-2)---fc 

(fc(fc-l)...(L|J+l))-(fc(fc-l)---(r|l+l)) 

(4s + l)(4s)---(2s + l) 

“ (((2s + l)(2s) • • • (s + 1) • (2s + l)(2s) • • • (s + 2))) 

(4s + l)(4s - 1) • • • (2s + 1) (4s)(4s - 2) • ■ • (2s + 2) 
(2s + l)(2s)---(s + l) (2s+l)(2s)---(s + 2)) 
(4s + l)(4s - 1) • • • (2s + 3) (4s)(4s - 2) • • • (2s + 4) 
(2s)(2s-l)---(s + l) (2s)(2s- l)---(s + 2)) 


> 


>2® • 2®“^ = 2^®“^ = 2''“^. 


Hence, we obtain 

Considering the even and odd cases in the same way, 
we can show that 


(fc-l)---(2fc + 2-2a) 


(L|J...(fc + 2-a))-(r|l---(A: + 2-a)) 


> 1- (E6) 


The condition k > a > implies that a > [|] +1. 
Hence, we have 


[—J + l>fc + 2 — a. 

Combining (IE5I) . (IE6I) . and (IE7I) . we have 
2fc - • • (2fe + 2 - 2a) 


(E7) 


=2k 


(fc---(fc + 2-a))2 

{2k - l){2k - 2) ■ • ■ (fc + 2){k + l)k 


>2k 


(A:(fc-l)...(L|J+l)).(fc(fc-l)--.(rfl+l)) 

(fc - 1) ■ • ■ (2fc + 2 - 2a) 

(L|j...(fc + 2-a)).(r|l---(fc + 2-a)) 

{2k - l){2k -2)---{k + 2){k + l)k 


>2k2 


(fc(fc-i)...(L|j + i)).(fc(fc-i)...(r|i + i)) 

fc -2 


(E8) 
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Thus, 

,, 2fc • • • (2fc + 2 — 2a) „ , 2 X 

(t...(t + 2-a))2 + -“) 

(а) 

> 2/c 2'=-2 - 2aA: + 2 ( 0 ^ - a) = 2(2'“'-2 - a)k + 2 ( 0 ^ - a) 

(б) (c) 

> 2 ( 2 fe -2 _ + 2(a2 - a) > 0, 

where (a), (6), and (c) follow from (IE8I) . the inequality 

I 


k > a, and the inequality A: > 4, respectively. 


9. Case: > 2 and a > & + 1 and a + b > 6 

Since the above cases cover all of cases with a + 6 < 5, 
we can assume that a + 6 > 6 in the following discussion 
as well as /c > 4, 6 > 2. Since b > 2 and a > 6 + 1, we 
have the following calculation. 


(2fc - l)(2fc - 3) • • • (2A: + 3 - 2b) {2k - 2){2k - 4) ■ ■ ■ {2k + 2 - 2b) (2fc + 1 - 2b){2k - 2b) ■ ■ ■ {2k + 2 - a - b) 

k{k — 1) ■ ■ ■ {k + 2 — b) k{k — 1) ■ ■ ■ {k + 2 — b) (fc + 1 — b){k — b) ■ ■ ■ {k + 2 — a) 

{2k - l){2k - 3) • ■ • (2A: + 5 - 26) (2fc + 3 - 2b) {2k - 2){2k - 4) ■ ■ ■ {2k + 4 - 2b) 

{k-l){k-2)---{k + 2-b) k (fc- l)(fc-2)---(fc + 2-6) 

(2A: + 2 - 2b) {2k + l- 2b) (2fc - 26) • ■ • (2fc + 2 - a - 6) 
k {k + 1 — b) {k — b) ■ ■ ■ {k + 2 — a) 

{2k - l){2k - 3) • ■ • (2A: + 5 - 26) {2k - 2){2k - 4) ■ ■ ■ {2k + 4 - 26) (2fc + 2 - 26) 

(fc-l)(fc-2)---(fc + 2-6) (fc-l)(fc-2)---(fc + 2-6) k 

(2A: - 26) ■ • • (2fe + 2 - a - 6) (2A: + 3 - 26) (2A: + 1 - 26) 

(fc — 6) • • • (fc + 2 — a) k {k + 1 — b) 

{2k - l)(2fc - 3) • ■ • (2A: + 5 - 26) {2k - 2){2k - 4) ■ ■ ■ {2k + 4 - 26) (2fc + 2 - 26) 

(/c-l)(fc-2)---(fc + 2-6) (/c-l)(fc-2)---(fc + 2-6) k 

{2k-2b)---{2k + 2-a- b) {2k + 1 - 26) (2A: + 3 - 26) 

(fc — 6) • • • (fc + 2 — a) k {k + 1 — b) 

(a) 

> 2k ■ 2^-2.2^-2.. 2 = 2“+'’-3fc, (E9) 


where (a) follows the following relations. We have 

(2fc-l)(2fc-3)---(2fc+5-2f)) ^ r,b-2 (2fc-2)(2fc-4)...(2fc+4-2b) _ 
(fc-l)(fc-2)...(fc+2-b) — ^ ’ {fc-l)(fc-2)...(fc+2-b) 


> 1, and > 2. 


r,b_2 (2fc+2-2b) ^ , (2fe+l-2h) 

^ ’ k — fe — (fe+l-&) — 

Also, the assumption guarantees the relation a > 2, 
which implies that > 2(“-^-i). 


Hence, 


2k - ■ ■ {2k + 2 — a — 6) 

^(fc---(fc + 2-a)) • (fc---(fc + 2-6)) 

— (a + b)k + {2ab — a — b) 

2k - • ■ {2k + 2 — a — 6) 

^(fc---(fc + 2-a)) • (fc---(fc + 2-6)) 

— (a + 6)fc + {2ab — a — b) 

(b) (c) 

> (2“+'’-3 - (a + 6))/fc + (2a6 - a - 6) > 0. 


where (6) and (c) follow from (IE9I) and the inequality 
a + 6 > 6, respectively. 


10. Case: b > k > a > b + 1, and k > 4 

The condition 6 > l + l implies 6 > fc + 1— [|J. Hence, 
we have [IJ +1 > (A: + 2 — 6). Thus, we have 

{2k - l){2k - 3) • ■ • (2A; + 3 - 26) 
k{k-l)---{k + 2-b) 
^ (2A:-l)(2fc-3)---(2LfJ+l) 

- A:(fc-1)...(L|J+1) 

(2fc-l)(2fc-3)-.-(2LfJ+2) (2LfJ+l) ^ 

(fc-l)(fc-2)...(L|J+l) k 

Since 6 > A: + 1 — [|] implies ([|] +1) > (A: + 2 — 6), we 
have 

{2k - 2){2k - 4)---{2k + 2-2b) 

A:(fc-l)---(A: + 2-6) 
^ (2fc-2)(2fc-4).-.(2r|l) 

- A:(fc-l)--.(r|l+l) 

(2fc-2)(2fc-4)---(2r|l+2) (2r|1) ^ 

(fc-i)(fc-2)...(r|i + i) k - 
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Hence, 


Thus, we have 


2k ■ ■ ■ (2k + 2 — a — b) 

{k ■ ■ ■ {k + 2 — a)) ■ {k ■ ■ ■ {k + 2 — b)) 

{2k - 1)(2A: - 3) ■ • ■ (2fc + 3 - 2b) 
k{k — 1) ■ ■ ■ {k + 2 — b) 

{2k - 2){2k - 4) • • • (2A: + 2 - 26) 
k{k — 1) • • • (fc + 2 — 6) 

(2fc + 1 - 2b){2k - 26) • • • (2fc + 2 - a - 6) 

(fc + 1 — 6)(A: — 6) • • • (fc + 2 — a) 

> {2k - 1)(2A: - 3) • • ■ (2fc + 3 - 26) 

~ k{k — 1) ■ • ■ (fc + 2 — 6) 

{2k - 2){2k - 4) • • • (2A: + 2 - 26) 
k{k — 1) ■ ■ ■ {k + 2 — b) 

>2k ■ 

^22fe-L|J-r#l-iyt = (ElO) 


^{a,b,k) 

2k ■ ■ ■ {2k + 2 — 0 — 6) 
^{k---{k + 2-a))-{k---{k + 2-b)) 

— (o + b)k + {2ab — a — b) 

(a) 

> 2^~^k — (a + b)k + {2ab — a — b) 

= (2'=-! - (o + b))k + {2ab - o - 6) 

(b) (c) 

> (2'=-^ -2k + l)k + {2ab - o - 6) > 0, 


where (a), (6), and (c) follow from (lElOl) . the inequality 
a + 6<2fc—1, and the inequality A: > 4, respectively. 
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